CVE-2026-86950 PDF exploit detector

For more context about this project and CVE-2026-86950, see https://decalage.info/CVE-2026-86950/

Disclaimer: most of this readme and the detection code have been written with the help of AI coding agents. The tool has been tested with success on thousands of legitimate PDF files and on the available proof-of-concept published here. However, this tool is new and the detection algorithm is rather complex so use it with caution.

detect_cve_2026_86950.py statically scans PDF files for embedded fonts crafted to exploit CVE-2026-86950 ("The Great Glyph Grift"), an out-of-bounds write in Apple CoreGraphics' anti-aliased glyph rasterizer (fixed in iOS / macOS 26.7.1).

It never renders the font or executes any exploit code — it parses the PDF and the embedded font program and looks for the structural signature of the attack.

The vulnerability (why the detection works)

CoreGraphics turns a floating-point device coordinate into a 16.12 fixed-point integer with roughly:

int32_t aa_double_to_fixed(double px) { return (int32_t)(0.5 + 4096.0 * px); }

When 4096 * px exceeds the range of int32, the cast is undefined behaviour, and two call sites (aa_moveto vs. aa_lineto) disagree — one saturates, one truncates. That disagreement corrupts the glyph bounding-box calculation in aa_add_edges, so the coverage buffer in aa_cache_render is allocated too small and the rasterizer writes out of bounds. The 26.7.1 patch adds explicit clamping to ±0x3FFFF001.

The public proof-of-concept builds a malicious TrueType font that forces such an oversized coordinate:

• a deep chain of composite glyphs, each scaling the previous one by ~2× (F2Dot14 scale near its max of ~1.99994);
• a tiny leaf glyph with a degenerate 2-point contour at a large coordinate;
• so the top glyph's real outline reaches ~16 million font units (~1000× the em square) while the glyph's stored bounding box stays tiny;
• at a large text size (/Tf 1024), 4096 × device_coord overflows int32.

What the detector checks

1. Extracts every embedded outline-font program with pikepdf — TrueType (/FontFile2) and CFF / OpenType (/FontFile3).
2. Parses each font with fontTools and measures each glyph's true coordinate extent:
   • TrueType: recursively resolves composite components (so a nested scaling chain is followed to its real extent);
   • CFF / Type2: draws each charstring through a control-bounds pen (so coordinates accumulated across many relative operators are measured).
3. Flags a font when any of these hold:
   • a glyph's real outline extends far beyond the em square (no legitimate glyph does — threshold 10× em, near-certain above 100× em);
   • the real extent dwarfs the glyph's own declared bounding box (the bounding-box "lie" the exploit depends on);
   • (TrueType only) deep composite nesting combined with up-scaling (>1) components — the coordinate-amplification chain the public PoC uses.
4. Combines the worst-case coordinate with the text sizes used in the page content streams (/Tf, Tm) and checks whether 4096 × device_coord actually exceeds INT32_MAX — i.e. whether the fixed-point overflow is reachable.

Verdicts: exploit (overflow reachable), suspicious (oversized geometry but not overflowing at the observed size), clean.

Install & run

# with uv (recommended)
uv venv
uv pip install -r requirements.txt

# or any environment with pikepdf + fonttools
python3 detect_cve_2026_86950.py suspicious.pdf
python3 detect_cve_2026_86950.py -v *.pdf      # per-font details
python3 detect_cve_2026_86950.py --json f.pdf  # machine-readable

Exit code: 0 clean, 1 exploit/suspicious found, 2 error.

Limitations

• The CVE's root cause is the fixed-point conversion in CoreGraphics' shared aa_* path rasterizer, which renders both TrueType glyf and CFF/Type2 outlines. The public PoC amplifies coordinates with TrueType composite glyphs; a CFF font can reach oversized coordinates directly (e.g. by accumulating relative operators), so both /FontFile2 and /FontFile3 are analyzed. The composite-chain heuristic is TrueType-specific; for CFF the signal is the oversized-coordinate / bounding-box-lie check.
• The text-size (/Tf, Tm) scan of content streams is best-effort; it does not fully evaluate the PDF graphics state / CTM. When no size is found, a conservative default of 1024 is assumed for the overflow check. The font-intrinsic oversized-geometry signals do not depend on this.
• This is a heuristic structural detector, not a sandboxed renderer: it is meant to catch the known exploit pattern and obviously-malformed fonts, not to prove a file is safe.